Is the MindMapVault server open source?

Yes. The server is licensed AGPL-3.0-or-later and published at github.com/mindmapvault/mindmapvault-server. You can read, build, run, and modify it under those terms.

Can a self-hosted server admin read users' mind maps?

No. Vaults are encrypted on the client before upload and the server stores only ciphertext. There is no admin override on a self-hosted instance, exactly as there is none on the hosted service.

Does self-hosting MindMapVault cost anything?

No. Self-hosting is free with no storage limits. Storage caps apply only to hosted cloud plans.

What does the self-hosted stack require?

Docker Engine with the Compose plugin, and host ports 8090, 5432, 9000, 3901 and 3903 free. The stack is three services: the server image, PostgreSQL 16, and Garage for S3-compatible object storage.

Self-hosted mind map

Run MindMapVault entirely on your own hardware: a homelab box, a VPS, or an internal server behind your firewall. The server is open source under AGPL-3.0, ships as a Docker image, and starts with one docker compose command.

The unusual part: self-hosting MindMapVault doesn’t make you the person who can read everyone’s maps. Vaults are encrypted client-side, so your own server stores ciphertext it cannot open. That’s a different guarantee from “I trust myself with the database” — the standard bargain for self-hosted mind mappers.

Quick start: the guided installer

The recommended path is a guided installer. It fetches what it needs, generates your secrets, brings the stack up, and waits until it’s actually ready. Run it in a dedicated deployment folder — not a source checkout:

mkdir -p ~/mindmapvault-deploy
cd ~/mindmapvault-deploy
curl -fsSL https://raw.githubusercontent.com/mindmapvault/mindmapvault-server/main/scripts/publish_dockerhub/setup.sh -o setup.sh
bash setup.sh

It downloads docker-compose.yml, .env.deploy.example and garage.toml, writes a .env.deploy with strong generated secrets, pulls the images, starts the services, and reports progress while it waits for readiness. It has an install mode and an update mode, so the same script handles your upgrades later.

When it finishes:

App: http://localhost:8090/
Admin: http://localhost:8090/admin/

Note that the script is downloaded to disk before it runs, rather than piped straight into a shell — read it first if you like. The prompt-by-prompt reference lives in the installer README, including what gen does at a secret prompt and how to reset a broken .env.deploy.

Day-to-day commands

docker compose --env-file .env.deploy ps          # status
docker compose --env-file .env.deploy logs -f server
docker compose --env-file .env.deploy down        # stop the stack

Upgrading

Rerun the installer from the same folder and choose update when prompted:

cd ~/mindmapvault-deploy
bash setup.sh

To pin a version instead of tracking latest, set SERVER_IMAGE when it asks — for example kornelko2/mindmapvault-server:1.2.4. Pinning is the sane choice for anything you intend to keep running.

Manual setup

Prefer no installer? Fetch the three files yourself and start Compose directly:

curl -fsSL https://raw.githubusercontent.com/mindmapvault/mindmapvault-server/main/scripts/publish_dockerhub/docker-compose.yml -o docker-compose.yml
curl -fsSL https://raw.githubusercontent.com/mindmapvault/mindmapvault-server/main/scripts/publish_dockerhub/.env.deploy.example -o .env.deploy
curl -fsSL https://raw.githubusercontent.com/mindmapvault/mindmapvault-server/main/docker/garage.toml -o garage.toml
# edit .env.deploy and set your secrets, then:
docker compose --env-file .env.deploy up -d

Keep runtime secrets in .env.deploy, and don’t commit it. If you’d rather build from the repository instead of pulling a published image, the deployment guide covers the source-checkout Compose path, reverse proxying, CORS, and troubleshooting.

What the stack runs

Three services, all defined in the repository’s docker-compose.yml:

service	what it does	required
`server`	API, the end-user app at `/`, and the admin UI at `/admin/`	Yes
`postgres`	accounts and vault metadata (PostgreSQL 16)	Yes
`garage`	S3-compatible object store for encrypted blobs and versioned writes	Yes

You can swap Garage for another S3-compatible store, but Compose-with-Garage is the path the repository actually documents and tests. Treat substitutions as a custom deployment and validate them yourself.

Requirements: Docker Engine with the Compose plugin, and host ports 8090, 5432, 9000, 3901, and 3903 free. Linux is the straightforward path; Windows works via Docker Desktop with WSL 2.

Where the images live

There is no build step and no registry login — the stack pulls a published image:

Docker Hub — kornelko2/mindmapvault-server — the default, and where the install documentation lives.
GitHub Container Registry — ghcr.io/mindmapvault/mindmapvault-server — the same builds, pullable anonymously.

Either registry works: set SERVER_IMAGE in .env.deploy (or answer the installer’s prompt) with the image and tag you want. Source for every image is in the mindmapvault-server repository if you’d rather read it or build it yourself.

Why encryption changes what self-hosting means

Most self-hosted mind mappers store maps in a database your admin account can read. That’s fine when the instance is only ever you. It stops being fine when you host for a family, a team, or a club — you become the person who could read everyone’s private thinking, and the person a database leak exposes.

MindMapVault removes that position. Keys are derived and held on the client; the server receives ciphertext and versioned encrypted blobs. Operating the box gives you uptime, backups, and data residency — not a window into content.

The honest cost: there is no admin override. If a user loses the credentials unlocking their vault, you cannot recover their maps, and neither can we. That’s the same guarantee working in the direction people don’t like. Plan for it before you onboard anyone else.

Backups

Because the server only ever holds ciphertext, backups are simpler than usual — snapshot the three named volumes and you have a complete, already-encrypted backup:

postgres-data    garage-meta    garage-data

Nothing extra to encrypt at rest, nothing readable if a backup disk goes missing. Back these up before any upgrade.

What you can’t back up is a user’s key. Document that for anyone you host, and make sure they hold their own credentials somewhere durable. See persistence and backups for volume specifics and upgrade-safe procedures.

Coming from another tool

If you’re replacing an existing self-hosted mapper, the two most common migrations:

WiseMapping — the classic open-source, self-hostable web mind mapper. The trade: WiseMapping wins on shared collaborative editing; MindMapVault wins on the server not being able to read maps, on a lighter Docker stack, and on having a desktop and mobile story.
FreeMind / Freeplane — MindMapVault imports .mm files directly (structure, text, notes, colors, links, fold state) and exports back to .mm, so a trial costs you nothing.

Frequently asked questions

Is the server open source?

Yes — the server is AGPL-3.0-or-later on GitHub. You can read it, build it, run it, and modify it under those terms.

Can I read my users’ maps as the server admin?

No. Vaults are encrypted on the client before upload; the server stores ciphertext only. This is deliberate, and it applies to your own instance exactly as it applies to our hosted one.

Does self-hosting cost anything?

No. Self-hosting is free and unlimited — storage caps are a hosted-plan concept, not a product limit. You bring the hardware.

Can I use my own S3 instead of Garage?

Yes, the object store is S3-compatible. Garage is what the repository documents and tests, so anything else is a custom deployment you should validate before trusting.

Do I need the cloud account for anything?

No. A self-hosted instance is standalone. Our hosted plans exist for people who don’t want to run infrastructure, and the free desktop app covers fully offline single-user work with no server at all.

Get started

Make a deployment folder and run the guided installer — it handles secrets, images, and startup.
Open http://localhost:8090/ and confirm the app renders before changing anything.
Only then adjust defaults — pinned image tag, CORS origins, reverse proxy — with the deployment guide and the Docker Hub install docs.

Hit a problem or want a feature? Open an issue.

Prefer no server at all? The desktop app is free, offline, and needs no account.